opensuse:kernel.git
11 years agoLinux 2.6.16.15
Chris Wright [Tue, 9 May 2006 19:53:30 +0000 (12:53 -0700)]
Linux 2.6.16.15

11 years ago[PATCH] SCTP: Prevent possible infinite recursion with multiple bundled DATA. (CVE...
Vladislav Yasevich [Sat, 6 May 2006 00:03:49 +0000 (17:03 -0700)]
[PATCH] SCTP: Prevent possible infinite recursion with multiple bundled DATA. (CVE-2006-2274)

There is a rare situation that causes lksctp to go into infinite recursion
and crash the system.  The trigger is a packet that contains at least the
first two DATA fragments of a message bundled together. The recursion is
triggered when the user data buffer is smaller that the full data message.
The problem is that we clone the skb for every fragment in the message.
When reassembling the full message, we try to link skbs from the "first
fragment" clone using the frag_list. However, since the frag_list is shared
between two clones in this rare situation, we end up setting the frag_list
pointer of the second fragment to point to itself.  This causes
sctp_skb_pull() to potentially recurse indefinitely.

Proposed solution is to make a copy of the skb when attempting to link
things using frag_list.

Signed-off-by: Vladislav Yasevich <vladsilav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
11 years ago[PATCH] SCTP: Allow spillover of receive buffer to avoid deadlock. (CVE-2006-2275)
Neil Horman [Sat, 6 May 2006 00:02:09 +0000 (17:02 -0700)]
[PATCH] SCTP: Allow spillover of receive buffer to avoid deadlock. (CVE-2006-2275)

This patch fixes a deadlock situation in the receive path by allowing
temporary spillover of the receive buffer.

- If the chunk we receive has a tsn that immediately follows the ctsn,
  accept it even if we run out of receive buffer space and renege data with
  higher TSNs.
- Once we accept one chunk in a packet, accept all the remaining chunks
  even if we run out of receive buffer space.

Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Mark Butler <butlerm@middle.net>
Acked-by: Vlad Yasevich <vladislav.yasevich@hp.com>
Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
11 years ago[PATCH] SCTP: Fix state table entries for chunks received in CLOSED state. (CVE-2006...
Sridhar Samudrala [Sat, 6 May 2006 00:05:23 +0000 (17:05 -0700)]
[PATCH] SCTP: Fix state table entries for chunks received in CLOSED state. (CVE-2006-2271)

Discard an unexpected chunk in CLOSED state rather can calling BUG().

Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
11 years ago[PATCH] SCTP: Fix panic's when receiving fragmented SCTP control chunks. (CVE-2006...
Sridhar Samudrala [Sat, 6 May 2006 00:04:43 +0000 (17:04 -0700)]
[PATCH] SCTP: Fix panic's when receiving fragmented SCTP control chunks. (CVE-2006-2272)

Use pskb_pull() to handle incoming COOKIE_ECHO and HEARTBEAT chunks that
are received as skb's with fragment list.

Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
11 years agoLinux 2.6.16.14
Chris Wright [Fri, 5 May 2006 00:03:45 +0000 (17:03 -0700)]
Linux 2.6.16.14

11 years ago[PATCH] smbfs chroot issue (CVE-2006-1864)
Olaf Kirch [Thu, 4 May 2006 04:30:11 +0000 (21:30 -0700)]
[PATCH] smbfs chroot issue (CVE-2006-1864)

Mark Moseley reported that a chroot environment on a SMB share can be
left via "cd ..\\".  Similar to CVE-2006-1863 issue with cifs, this fix
is for smbfs.

Steven French <sfrench@us.ibm.com> wrote:

Looks fine to me.  This should catch the slash on lookup or equivalent,
which will be all obvious paths of interest.

Signed-off-by: Chris Wright <chrisw@sous-sol.org>
11 years agoLinux 2.6.16.13
Greg Kroah-Hartman [Tue, 2 May 2006 21:38:44 +0000 (14:38 -0700)]
Linux 2.6.16.13

11 years ago[PATCH] NETFILTER: SCTP conntrack: fix infinite loop (CVE-2006-1527)
Patrick McHardy [Tue, 2 May 2006 21:23:07 +0000 (23:23 +0200)]
[PATCH] NETFILTER: SCTP conntrack: fix infinite loop (CVE-2006-1527)

[NETFILTER]: SCTP conntrack: fix infinite loop

fix infinite loop in the SCTP-netfilter code: check SCTP chunk size to
guarantee progress of for_each_sctp_chunk(). (all other uses of
for_each_sctp_chunk() are preceded by do_basic_checks(), so this fix
should be complete.)

Based on patch from Ingo Molnar <mingo@elte.hu>

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years agoLinux 2.6.16.12
Greg Kroah-Hartman [Mon, 1 May 2006 19:14:26 +0000 (12:14 -0700)]
Linux 2.6.16.12

11 years ago[PATCH] i386: fix broken FP exception handling
Chuck Ebbert [Sat, 29 Apr 2006 18:07:49 +0000 (14:07 -0400)]
[PATCH] i386: fix broken FP exception handling

The FXSAVE information leak patch introduced a bug in FP exception
handling: it clears FP exceptions only when there are already
none outstanding.  Mikael Pettersson reported that causes problems
with the Erlang runtime and has tested this fix.

Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com>
Acked-by: Mikael Pettersson <mikpe@it.uu.se>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] MIPS: Fix branch emulation for floating-point exceptions.
Win Treese [Wed, 26 Apr 2006 23:00:04 +0000 (00:00 +0100)]
[PATCH] MIPS: Fix branch emulation for floating-point exceptions.

In the branch emulation for floating-point exceptions, __compute_return_epc
must determine for bc1f et al which condition code bit to test. This is
based on bits <4:2> of the rt field. The switch statement to distinguish
bc1f et al needs to use only the two low bits of rt, but the old code tests
on the whole rt field.  This patch masks off the proper bits.

Signed-off-by: Win Treese <treese@acm.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] MIPS: Fix tx49_blast_icache32_page_indexed.
Atsushi Nemoto [Wed, 26 Apr 2006 23:00:03 +0000 (00:00 +0100)]
[PATCH] MIPS: Fix tx49_blast_icache32_page_indexed.

Fix the cache index value in tx49_blast_icache32_page_indexed().
This is damage by de62893bc0725f8b5f0445250577cd7a10b2d8f8 commit.

Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] MIPS: R2 build fixes for gcc < 3.4.
Ralf Baechle [Wed, 26 Apr 2006 23:00:02 +0000 (00:00 +0100)]
[PATCH] MIPS: R2 build fixes for gcc < 3.4.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] MIPS: Use "R" constraint for cache_op.
Ralf Baechle [Wed, 26 Apr 2006 23:00:01 +0000 (00:00 +0100)]
[PATCH] MIPS: Use "R" constraint for cache_op.

Gcc might emit an absolute address for the the "m" constraint which
gas unfortunately does not permit.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] NET: e1000: Update truesize with the length of the packet for packet split
Auke Kok [Wed, 26 Apr 2006 06:16:29 +0000 (23:16 -0700)]
[PATCH] NET: e1000: Update truesize with the length of the packet for packet split

Update skb with the real packet size.

Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Auke Kok <auke-jan.h.kok@intel.com>
Signed-off-by: John Ronciak <john.ronciak@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] x86/PAE: Fix pte_clear for the >4GB RAM case
Zachary Amsden [Thu, 27 Apr 2006 20:01:39 +0000 (20:01 +0000)]
[PATCH] x86/PAE: Fix pte_clear for the >4GB RAM case

Proposed fix for ptep_get_and_clear_full PAE bug.  Pte_clear had the same bug,
so use the same fix for both.  Turns out pmd_clear had it as well, but pgds
are not affected.

The problem is rather intricate.  Page table entries in PAE mode are 64-bits
wide, but the only atomic 8-byte write operation available in 32-bit mode is
cmpxchg8b, which is expensive (at least on P4), and thus avoided.  But it can
happen that the processor may prefetch entries into the TLB in the middle of an
operation which clears a page table entry.  So one must always clear the P-bit
in the low word of the page table entry first when clearing it.

Since the sequence *ptep = __pte(0) leaves the order of the write dependent on
the compiler, it must be coded explicitly as a clear of the low word followed
by a clear of the high word.  Further, there must be a write memory barrier
here to enforce proper ordering by the compiler (and, in the future, by the
processor as well).

On > 4GB memory machines, the implementation of pte_clear for PAE was clearly
deficient, as it could leave virtual mappings of physical memory above 4GB
aliased to memory below 4GB in the TLB.  The implementation of
ptep_get_and_clear_full has a similar bug, although not nearly as likely to
occur, since the mappings being cleared are in the process of being destroyed,
and should never be dereferenced again.

But, as luck would have it, it is possible to trigger bugs even without ever
dereferencing these bogus TLB mappings, even if the clear is followed fairly
soon after with a TLB flush or invalidation.  The problem is that memory above
4GB may now be aliased into the first 4GB of memory, and in fact, may hit a
region of memory with non-memory semantics.  These regions include AGP and PCI
space.  As such, these memory regions are not cached by the processor.  This
introduces the bug.

The processor can speculate memory operations, including memory writes, as long
as they are committed with the proper ordering.  Speculating a memory write to
a linear address that has a bogus TLB mapping is possible.  Normally, the
speculation is harmless.  But for cached memory, it does leave the falsely
speculated cacheline unmodified, but in a dirty state.  This cache line will be
eventually written back.  If this cacheline happens to intersect a region of
memory that is not protected by the cache coherency protocol, it can corrupt
data in I/O memory, which is generally a very bad thing to do, and can cause
total system failure or just plain undefined behavior.

These bugs are extremely unlikely, but the severity is of such magnitude, and
the fix so simple that I think fixing them immediately is justified.  Also,
they are nearly impossible to debug.

Signed-off-by: Zachary Amsden <zach@vmware.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] LSM: add missing hook to do_compat_readv_writev()
James Morris [Wed, 26 Apr 2006 15:11:00 +0000 (15:11 +0000)]
[PATCH] LSM: add missing hook to do_compat_readv_writev()

This patch addresses a flaw in LSM, where there is no mediation of readv()
and writev() in for 32-bit compatible apps using a 64-bit kernel.

This bug was discovered and fixed initially in the native readv/writev
code [1], but was not fixed in the compat code.  Thanks to Al for spotting
this one.

  [1] http://lwn.net/Articles/154282/

Signed-off-by: James Morris <jmorris@namei.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
11 years ago[PATCH] Alpha: strncpy() fix
Ivan Kokshaysky [Tue, 25 Apr 2006 14:59:34 +0000 (14:59 +0000)]
[PATCH] Alpha: strncpy() fix

As it turned out after recent SCSI changes, strncpy() was broken -
it mixed up the return values from __stxncpy() in registers $24 and $27.

Thanks to Mathieu Chouquet-Stringer for tracking down the problem
and providing an excellent test case.

Signed-off-by: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] Altix snsc: duplicate kobject fix
Greg Howard [Sun, 23 Apr 2006 17:10:42 +0000 (17:10 +0000)]
[PATCH] Altix snsc: duplicate kobject fix

Fix Altix system controller (snsc) device names to include the slot number
of the blade whose associated system controller is the target of the device
interface.  Including the slot number avoids a problem we're currently
having where slots within the same enclosure are attempting to create
multiple kobjects with identical names.

Signed-off-by: Greg Howard <ghoward@sgi.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] Fix reiserfs deadlock
Jan Kara [Sun, 23 Apr 2006 17:10:44 +0000 (17:10 +0000)]
[PATCH] Fix reiserfs deadlock

reiserfs_cache_default_acl() should return whether we successfully found
the acl or not.  We have to return correct value even if reiserfs_get_acl()
returns error code and not just 0.  Otherwise callers such as
reiserfs_mkdir() can unnecessarily lock the xattrs and later functions such
as reiserfs_new_inode() fail to notice that we have already taken the lock
and try to take it again with obvious consequences.

Signed-off-by: Jan Kara <jack@suse.cz>
Cc: <reiserfs-dev@namesys.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] Simplify proc/devices and fix early termination regression
Andrew Morton [Fri, 21 Apr 2006 08:51:36 +0000 (01:51 -0700)]
[PATCH] Simplify proc/devices and fix early termination regression

Repair /proc/devices early-termination regression.

2.6.16 broke /proc/devices.  An application often gets an
EOF before the end of data is reached, if that application
uses a series of short read(2)s to access the data.  I have
used read buffers of varying sizes with varying degrees
of unsuccess (larger sizes get further into the data than
smaller sizes, following a simple pattern).  It appears
that the only safe way to get the data is to use a single
read buffer larger than all the data in /proc/devices.

The following example demonstates the problem:

    # dd if=/proc/devices bs=1
    Character devices:
      1 mem
    27+0 records in
    27+0 records out

This patch is a backport of the fix recently accepted to
Linus's tree:

    commit 68eef3b4791572ecb70249c7fb145bb3742dd899
    [PATCH] Simplify proc/devices and fix early termination regression

It replaces the complex, state-machine algorithm introduced
in 2.6.16 with a simple algorithm, modeled on the implementation
of /proc/interrupts.

[akpm@osdl.org: cleanups, simplifications]

Signed-off-by: Joe Korty <joe.korty@ccur.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] dm flush queue EINTR
Jun'ichi Nomura [Mon, 27 Mar 2006 09:17:51 +0000 (01:17 -0800)]
[PATCH] dm flush queue EINTR

If dm_suspend() is cancelled, bios already added to the deferred list need to
be submitted.  Otherwise they remain 'in limbo' until there's a dm_resume().

Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] dm snapshot: fix kcopyd destructor
Alasdair G Kergon [Mon, 24 Apr 2006 20:36:06 +0000 (13:36 -0700)]
[PATCH] dm snapshot: fix kcopyd destructor

Before removing a snapshot, wait for the completion of any kcopyd jobs using
it.

Do this by maintaining a count (nr_jobs) of how many outstanding jobs each
kcopyd_client has.

The snapshot destructor first unregisters the snapshot so that no new kcopyd
jobs (created by writes to the origin) will reference that particular
snapshot.  kcopyd_client_destroy() is now run next to wait for the completion
of any outstanding jobs before the snapshot exception structures (that those
jobs reference) are freed.

Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] cxusb-bluebird: bug-fix: power down corrupts frontend
Michael Krufky [Sat, 22 Apr 2006 07:35:50 +0000 (03:35 -0400)]
[PATCH] cxusb-bluebird: bug-fix: power down corrupts frontend

This patch prevents a bug where the frontend is unable to tune after waking
from powered down state. Now, the device remains powered on until it is
disconnected, just like the windows driver. It seems that the bluebird
firmware is unable to successfully handle tuning after a powered down state.

This patch fixes all of the FusionHDTV Bluebird USB2 devices. The Medion
MD95700 will still behave as before, since it was unaffected by this bug.

Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] fix saa7129 support in saa7127 module for pvr350 tv out
Jose Alberto Reguero [Sat, 22 Apr 2006 07:35:45 +0000 (03:35 -0400)]
[PATCH] fix saa7129 support in saa7127 module for pvr350 tv out

This patch fixes tv-out support for the newer model of
the pvr350, which has a saa7129 instead of a saa7127
video encoder.

Signed-off-by: Jose Alberto Reguero <jareguero@telefonica.net>
Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] for_each_possible_cpu
Andrew Morton [Mon, 24 Apr 2006 08:49:59 +0000 (01:49 -0700)]
[PATCH] for_each_possible_cpu

Backport for_each_possible_cpu() into 2.6.16.  Fixes the alpha build, and any
future occurrences.

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] get_dvb_firmware: download nxt2002 firmware from new driver location
Michael Krufky [Sun, 23 Apr 2006 06:16:42 +0000 (02:16 -0400)]
[PATCH] get_dvb_firmware: download nxt2002 firmware from new driver location

BBTI has updated their driver, and removed the old one from their website.
This patch updates the get_dvb_firmware script to download the firmware
from the new driver location.

Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] tipar oops fix
Daniel Drake [Sun, 23 Apr 2006 22:43:59 +0000 (15:43 -0700)]
[PATCH] tipar oops fix

If compiled into the kernel, parport_register_driver() is called before the
parport driver has been initalised.

This means that it is expected that tp_count is 0 after the
parport_register_driver() call() - tipar's attach function will not be
called until later during bootup.

Signed-off-by: Daniel Drake <dsd@gentoo.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] USB: fix array overrun in drivers/usb/serial/option.c
Eric Sesterhenn [Sun, 23 Apr 2006 20:52:28 +0000 (22:52 +0200)]
[PATCH] USB: fix array overrun in drivers/usb/serial/option.c

since the arrays are declared as in_urbs[N_IN_URB]
and out_urbs[N_OUT_URB] both for loops, go one
over the end of the array. This fixes coverity id #555

This patch was already included in Linus' tree.

Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] x86_64: Fix a race in the free_iommu path.
Mike Waychison [Fri, 21 Apr 2006 07:43:25 +0000 (09:43 +0200)]
[PATCH] x86_64: Fix a race in the free_iommu path.

We do this by removing a micro-optimization that tries to avoid grabbing
the iommu_bitmap_lock spinlock and using a bus-locked operation.

This still races with other simultaneous alloc_iommu or free_iommu(size
> 1) which both use bus-unlocked operations.

The end result of this race is eventually ending
up with an iommu_gart_bitmap that has bits errornously set all over,
making large contiguous iommu space allocations fail with 'PCI-DMA:
Out of IOMMU space'.

Signed-off-by: Mike Waychison <mikew@google.com>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] x86_64: Pass -32 to the assembler when compiling the 32bit vsyscall pages
Andi Kleen [Fri, 21 Apr 2006 07:43:22 +0000 (09:43 +0200)]
[PATCH] x86_64: Pass -32 to the assembler when compiling the 32bit vsyscall pages

This quietens warnings and actually fixes a bug. The unwind tables would
come out wrong without -32, causing pthread cancellation during them
to crash in the gcc runtime.

The problem seems to only happen with newer binutils
(it doesn't happen with 2.16.91.0.2 but happens wit 2.16.91.0.5)

Thanks to Brian Baker @ HP for test case and initial analysis.

Cc: brian.b@hp.com
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] make vm86 call audit_syscall_exit
Jason Baron [Tue, 31 Jan 2006 21:56:28 +0000 (16:56 -0500)]
[PATCH] make vm86 call audit_syscall_exit

hi,

The motivation behind the patch below was to address messages in
/var/log/messages such as:

Jan 31 10:54:15 mets kernel: audit(:0): major=252 name_count=0: freeing
multiple contexts (1)
Jan 31 10:54:15 mets kernel: audit(:0): major=113 name_count=0: freeing
multiple contexts (2)

I can reproduce by running 'get-edid' from:
http://john.fremlin.de/programs/linux/read-edid/.

These messages come about in the log b/c the vm86 calls do not exit via
the normal system call exit paths and thus do not call
'audit_syscall_exit'. The next system call will then free the context for
itself and for the vm86 context, thus generating the above messages. This
patch addresses the issue by simply adding a call to 'audit_syscall_exit'
from the vm86 code.

Besides fixing the above error messages the patch also now allows vm86
system calls to become auditable. This is useful since strace does not
appear to properly record the return values from sys_vm86.

I think this patch is also a step in the right direction in terms of
cleaning up some core auditing code. If we can correct any other paths
that do not properly call the audit exit and entries points, then we can
also eliminate the notion of context chaining.

I've tested this patch by verifying that the log messages no longer
appear, and that the audit records for sys_vm86 appear to be correct.
Also, 'read_edid' produces itentical output.

thanks,

-Jason

Signed-off-by: Jason Baron <jbaron@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] cs5535_gpio.c: call cdev_del() during module_exit to unmap kobject references...
Thayumanavar Sachithanantham [Thu, 20 Apr 2006 16:00:56 +0000 (16:00 +0000)]
[PATCH] cs5535_gpio.c: call cdev_del() during module_exit to unmap kobject references and other cleanups

During module unloading, cdev_del() must be called to unmap cdev related
kobject references and other cleanups(such as inode->i_cdev being set to
NULL) which prevents the OOPS upon subsequent loading, usage and unloading
of modules(as seen in the mail thread
http://marc.theaimsgroup.com/?l=linux-kernel&m=114533640609018&w=2).

Also, remove unneeded test of gpio_base.

Signed-off-by: Thayumanavar Sachithanantham <thayumk@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] sonypi: correct detection of new ICH7-based laptops
Arnaud MAZIN [Thu, 20 Apr 2006 16:01:02 +0000 (16:01 +0000)]
[PATCH] sonypi: correct detection of new ICH7-based laptops

Add a test to detect the ICH7 based Core Duo SONY laptops (such as the SZ1)
as type3 models.

Signed-off-by: Arnaud MAZIN <arnaud.mazin@gmail.com>
Acked-by: Stelian Pop <stelian@poppies.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years agoLinux 2.6.16.11
Greg Kroah-Hartman [Mon, 24 Apr 2006 20:20:24 +0000 (13:20 -0700)]
Linux 2.6.16.11

11 years ago[PATCH] Don't allow a backslash in a path component (CVE-2006-1863)
Steve French [Fri, 21 Apr 2006 18:18:37 +0000 (18:18 +0000)]
[PATCH] Don't allow a backslash in a path component (CVE-2006-1863)

Unless Posix paths have been negotiated, the backslash, "\", is not a valid
character in a path component.

Signed-off-by: Dave Kleikamp <shaggy@austin.ibm.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years agoLinux 2.6.16.10
Greg Kroah-Hartman [Mon, 24 Apr 2006 17:07:37 +0000 (10:07 -0700)]
Linux 2.6.16.10

11 years ago[PATCH] IPC: access to unmapped vmalloc area in grow_ary()
Alexey Kuznetsov [Tue, 18 Apr 2006 03:04:00 +0000 (03:04 +0000)]
[PATCH] IPC: access to unmapped vmalloc area in grow_ary()

grow_ary() should not copy struct ipc_id_ary (it copies new->p, not
new). Due to this, memcpy() src pointer could hit unmapped vmalloc page
when near page boundary.

Found during OpenVZ stress testing

Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] Add more prevent_tail_call()
OGAWA Hirofumi [Wed, 19 Apr 2006 23:59:40 +0000 (23:59 +0000)]
[PATCH] Add more prevent_tail_call()

Those also break userland regs like following.

   00000000 <sys_chown16>:
      0: 0f b7 44 24 0c        movzwl 0xc(%esp),%eax
      5: 83 ca ff              or     $0xffffffff,%edx
      8: 0f b7 4c 24 08        movzwl 0x8(%esp),%ecx
      d: 66 83 f8 ff           cmp    $0xffffffff,%ax
     11: 0f 44 c2              cmove  %edx,%eax
     14: 66 83 f9 ff           cmp    $0xffffffff,%cx
     18: 0f 45 d1              cmovne %ecx,%edx
     1b: 89 44 24 0c           mov    %eax,0xc(%esp)
     1f: 89 54 24 08           mov    %edx,0x8(%esp)
     23: e9 fc ff ff ff        jmp    24 <sys_chown16+0x24>

where the tailcall at the end overwrites the incoming stack-frame.

Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] alim15x3: ULI M-1573 south Bridge support
KAI.HSU [Wed, 19 Apr 2006 17:01:17 +0000 (17:01 +0000)]
[PATCH] alim15x3: ULI M-1573 south Bridge support

>From http://bugzilla.kernel.org/show_bug.cgi?id=6358

The alim15x3.c havn't been update for 3 years.  Recently when we use this
"ULI M1573" south bridge chip found that can't mount CDROM(VCD) smoothly,
must waiting for a long time.  After I check the "ULI M1573" south bridge
datasheet, I found the reason.  The reason is the "ULI M1573" version in
the Linux is "0xC7" not "0xC4" anymore So I was modified the source than it
was successed.

Cc: Bartlomiej Zolnierkiewicz <B.Zolnierkiewicz@elka.pw.edu.pl>
Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] apm: fix Armada laptops again
Samuel Thibault [Wed, 19 Apr 2006 17:00:54 +0000 (17:00 +0000)]
[PATCH] apm: fix Armada laptops again

Fix the "apm: set display: Interface not engaged" error on Armada laptops
again.

Jordan said:

  I think this is fine.  It seems to me that this may be the fault of one or
  both of the APM solutions handling this situation in a non-standard way, but
  since APM is used very little on the Geode, and I have direct access to our
  BIOS folks, if this problem comes up with a customer again, we'll solve it
  from the firmware.

Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Cc: "Jordan Crouse" <jordan.crouse@amd.com>
Cc: Zachary Amsden <zach@vmware.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] fbdev: Fix return error of fb_write
Antonino A. Daplas [Wed, 19 Apr 2006 17:01:21 +0000 (17:01 +0000)]
[PATCH] fbdev: Fix return error of fb_write

Fix return code of fb_write():

If at least 1 byte was transferred to the device, return number of bytes,
otherwise:

    - return -EFBIG - if file offset is past the maximum allowable offset or
      size is greater than framebuffer length
    - return -ENOSPC - if size is greater than framebuffer length - offset

Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] Fix file lookup without ref
Dipankar Sarma [Wed, 19 Apr 2006 17:00:12 +0000 (17:00 +0000)]
[PATCH] Fix file lookup without ref

There are places in the kernel where we look up files in fd tables and
access the file structure without holding refereces to the file.  So, we
need special care to avoid the race between looking up files in the fd
table and tearing down of the file in another CPU.  Otherwise, one might
see a NULL f_dentry or such torn down version of the file.  This patch
fixes those special places where such a race may happen.

Signed-off-by: Dipankar Sarma <dipankar@in.ibm.com>
Acked-by: "Paul E. McKenney" <paulmck@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] m41t00: fix bitmasks when writing to chip
David Barksdale [Wed, 19 Apr 2006 16:59:54 +0000 (16:59 +0000)]
[PATCH] m41t00: fix bitmasks when writing to chip

Fix the bitmasks used when writing to the M41T00 registers.

The original code used a mask of 0x7f when writing to each register,
this is incorrect and probably the result of a copy-paste error.  As a
result years from 1980 to 1999 will be read back as 2000 to 2019.

Signed-off-by: David Barksdale <amatus@ocgnet.org>
Acked-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] Open IPMI BT overflow
Heikki Orsila [Wed, 19 Apr 2006 17:01:01 +0000 (17:01 +0000)]
[PATCH] Open IPMI BT overflow

I was looking into random driver code and found a suspicious looking
memcpy() in drivers/char/ipmi/ipmi_bt_sm.c on 2.6.17-rc1:

if ((size < 2) || (size > IPMI_MAX_MSG_LENGTH))
return -1;
...
memcpy(bt->write_data + 3, data + 1, size - 1);

where sizeof bt->write_data is IPMI_MAX_MSG_LENGTH.  It looks like the
memcpy would overflow by 2 bytes if size == IPMI_MAX_MSG_LENGTH.  A patch
attached to limit size to (IPMI_MAX_LENGTH - 2).

Cc: Corey Minyard <minyard@acm.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] x86: be careful about tailcall breakage for sys_open[at] too
Linus Torvalds [Tue, 18 Apr 2006 20:59:27 +0000 (20:59 +0000)]
[PATCH] x86: be careful about tailcall breakage for sys_open[at] too

x86: be careful about tailcall breakage for sys_open[at] too

Came up through a quick grep for other cases similar to the ftruncate()
one in commit 0a489cb3b6a7b277030cdbc97c2c65905db94536.

Also, add a comment, so that people who read the code understand why we
do what looks like a no-op.

(Again, this won't actually matter to any sane user, since libc will
save and restore the register gcc stomps on, but it's still wrong to
stomp on it)

Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] x86: don't allow tail-calls in sys_ftruncate[64]()
Linus Torvalds [Tue, 18 Apr 2006 20:59:26 +0000 (20:59 +0000)]
[PATCH] x86: don't allow tail-calls in sys_ftruncate[64]()

x86: don't allow tail-calls in sys_ftruncate[64]()

Gcc thinks it owns the incoming argument stack, but that's not true for
"asmlinkage" functions, and it corrupts the caller-set-up argument stack
when it pushes the third argument onto the stack.  Which can result in
%ebx getting corrupted in user space.

Now, normally nobody sane would ever notice, since libc will save and
restore %ebx anyway over the system call, but it's still wrong.

I'd much rather have "asmlinkage" tell gcc directly that it doesn't own
the stack, but no such attribute exists, so we're stuck with our hacky
manual "prevent_tail_call()" macro once more (we've had the same issue
before with sys_waitpid() and sys_wait4()).

Thanks to Hans-Werner Hilse <hilse@sub.uni-goettingen.de> for reporting
the issue and testing the fix.

Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] IPV6: XFRM: Fix decoding session with preceding extension header(s).
YOSHIFUJI Hideaki / \e$B5HF#1QL@\e(B [Wed, 19 Apr 2006 02:14:23 +0000 (11:14 +0900)]
[PATCH] IPV6: XFRM: Fix decoding session with preceding extension header(s).

[IPV6] XFRM: Fix decoding session with preceding extension header(s).

We did not correctly decode session with preceding extension
header(s).  This was because we had already pulled preceding
headers, skb->nh.raw + 40 + 1 - skb->data was minus, and
pskb_may_pull() failed.

We now have IP6CB(skb)->nhoff and skb->h.raw, and we can
start parsing / decoding upper layer protocol from current
position.

Tracked down by Noriaki TAKAMIYA <takamiya@po.ntts.co.jp>
and tested by Kazunori Miyazawa <kazunori@miyazawa.org>.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] IPV6: XFRM: Don't use old copy of pointer after pskb_may_pull().
YOSHIFUJI Hideaki / \e$B5HF#1QL@\e(B [Wed, 19 Apr 2006 02:14:07 +0000 (11:14 +0900)]
[PATCH] IPV6: XFRM: Don't use old copy of pointer after pskb_may_pull().

[IPV6] XFRM: Don't use old copy of pointer after pskb_may_pull().

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] IPV6: Ensure to have hop-by-hop options in our header of &sk_buff.
YOSHIFUJI Hideaki / \e$B5HF#1QL@\e(B [Wed, 19 Apr 2006 02:13:58 +0000 (11:13 +0900)]
[PATCH] IPV6: Ensure to have hop-by-hop options in our header of &sk_buff.

[IPV6]: Ensure to have hop-by-hop options in our header of &sk_buff.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] selinux: Fix MLS compatibility off-by-one bug
Ron Yorston [Wed, 19 Apr 2006 05:21:04 +0000 (22:21 -0700)]
[PATCH] selinux: Fix MLS compatibility off-by-one bug

Fix an off-by-one error in the MLS compatibility code that was causing
contexts with a MLS suffix to be rejected, preventing sharing partitions
between FC4 and FC5.  Bug reported in
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=188068

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: James Morris <jmorris@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] PPC: fix oops in alsa powermac driver
Guido Guenther [Thu, 20 Apr 2006 18:59:10 +0000 (20:59 +0200)]
[PATCH] PPC: fix oops in alsa powermac driver

this fixes an oops in 2.6.16.X when loading the snd_powermac module. The
name of the requested module changed during the 2.6.16 development cycle
from i2c-keylargo to i2c-powermac:

Signed-off-by: Guido Guenther <agx@sigxcpu.org>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] MTD_NAND_SHARPSL and MTD_NAND_NANDSIM should be tristate's
Adrian Bunk [Tue, 18 Apr 2006 23:49:31 +0000 (01:49 +0200)]
[PATCH] MTD_NAND_SHARPSL and MTD_NAND_NANDSIM should be tristate's

MTD_NAND=m and MTD_NAND_SHARPSL=y or MTD_NAND_NANDSIM=y are illegal
combinations that mustn't be allowed.

This patch fixes this bug by making MTD_NAND_SHARPSL and MTD_NAND_NANDSIM
tristate's.

Additionally, it fixes some whitespace damage at these options.

This patch was already included in Linus' tree.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] i2c-i801: Fix resume when PEC is used
Jean Delvare [Tue, 18 Apr 2006 12:15:59 +0000 (14:15 +0200)]
[PATCH] i2c-i801: Fix resume when PEC is used

Fix for bug #6395:
Fail to resume on Tecra M2 with ADM1032 and Intel 82801DBM

The BIOS of the Tecra M2 doesn't like it when it has to reboot or
resume after the i2c-i801 driver has left the SMBus in PEC mode.
I have a more complete fix for 2.6.17 but the simple approach of
leaving the SMBus in non-PEC mode after every transaction should do
for -stable. That's what the i2c-i801 driver was doing up to 2.6.15
(inclusive).

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] Fix hotplug race during device registration
Thomas de Grenier de Latour [Wed, 19 Apr 2006 04:22:39 +0000 (10:22 +0600)]
[PATCH] Fix hotplug race during device registration

On Sun, 9 Apr 2006 21:56:59 +0400,
Sergey Vlasov <vsu@altlinux.ru> wrote:
> However, show_address() does not output anything unless
> dev->reg_state == NETREG_REGISTERED - and this state is set by
> netdev_run_todo() only after netdev_register_sysfs() returns, so in
> the meantime (while netdev_register_sysfs() is busy adding the
> "statistics" attribute group) some process may see an empty "address"
> attribute.

I've tried the attached patch, suggested by Sergey Vlasov on
hotplug-devel@, and as far as i can test it works just fine.

Signed-off-by: Alexander Patrakov <patrakov@ums.usu.ru>
Signed-off-by: David Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] Fix truesize underflow
Herbert Xu [Wed, 19 Apr 2006 04:43:31 +0000 (21:43 -0700)]
[PATCH] Fix truesize underflow

[TCP]: Fix truesize underflow

There is a problem with the TSO packet trimming code.  The cause of
this lies in the tcp_fragment() function.

When we allocate a fragment for a completely non-linear packet the
truesize is calculated for a payload length of zero.  This means that
truesize could in fact be less than the real payload length.

When that happens the TSO packet trimming can cause truesize to become
negative.  This in turn can cause sk_forward_alloc to be -n * PAGE_SIZE
which would trigger the warning.

I've copied the code DaveM used in tso_fragment which should work here.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] efficeon-agp: Add missing memory mask
H. Peter Anvin [Sat, 15 Apr 2006 00:30:24 +0000 (17:30 -0700)]
[PATCH] efficeon-agp: Add missing memory mask

Original patch by Benjamin Herrenschmidt after debugging by Brian Hinz.

Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Brian Hinz <bphinz@hotmail.com>
Signed-off-by: H Peter Anvin <hpa@zytor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] 3ware 9000 disable local irqs during kmap_atomic
adam radford [Tue, 11 Apr 2006 18:25:09 +0000 (11:25 -0700)]
[PATCH] 3ware 9000 disable local irqs during kmap_atomic

The attached patch for 2.6.17-rc2 updates the 3ware 9000 driver:

- Disable local interrupts during kmap/unmap_atomic().

Signed-off-by: Adam Radford <linuxraid@amcc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] 3ware: kmap_atomic() fix
Andrew Morton [Fri, 14 Apr 2006 21:52:14 +0000 (14:52 -0700)]
[PATCH] 3ware: kmap_atomic() fix

We must disable local IRQs while holding KM_IRQ0 or KM_IRQ1.  Otherwise, an
IRQ handler could use those kmap slots while this code is using them,
resulting in memory corruption.

Thanks to Nick Orlov <bugfixer@list.ru> for reporting.

Cc: <linuxraid@amcc.com>
Cc: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years agoLinux 2.6.16.9
Greg Kroah-Hartman [Wed, 19 Apr 2006 06:10:14 +0000 (23:10 -0700)]
Linux 2.6.16.9

11 years ago[PATCH] i386/x86-64: Fix x87 information leak between processes (CVE-2006-1056)
Andi Kleen [Wed, 19 Apr 2006 05:17:31 +0000 (07:17 +0200)]
[PATCH] i386/x86-64: Fix x87 information leak between processes (CVE-2006-1056)

AMD K7/K8 CPUs only save/restore the FOP/FIP/FDP x87 registers in FXSAVE
when an exception is pending.  This means the value leak through context
switches and allow processes to observe some x87 instruction state of
other processes.

This was actually documented by AMD, but nobody recognized it as being
different from Intel before.

The fix first adds an optimization: instead of unconditionally calling
FNCLEX after each FXSAVE test if ES is pending and skip it when not
needed. Then do a x87 load from a kernel variable to clear FOP/FIP/FDP.

This means other processes always will only see a constant value defined
by the kernel in their FP state.

I took some pain to make sure to chose a variable that's already in L1
during context switch to make the overhead of this low.

Also alternative() is used to patch away the new code on CPUs who don't
need it.

Patch for both i386/x86-64.

The problem was discovered originally by Jan Beulich. Richard Brunner
provided the basic code for the workarounds, with contribution from Jan.

This is CVE-2006-1056

Cc: richard.brunner@amd.com
Cc: jbeulich@novell.com
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years agoLinux 2.6.16.8
Greg Kroah-Hartman [Tue, 18 Apr 2006 21:32:07 +0000 (14:32 -0700)]
Linux 2.6.16.8

11 years ago[PATCH] ip_route_input panic fix (CVE-2006-1525)
Stephen Hemminger [Tue, 18 Apr 2006 00:27:11 +0000 (17:27 -0700)]
[PATCH] ip_route_input panic fix (CVE-2006-1525)

This fixes http://bugzilla.kernel.org/show_bug.cgi?id=6388
The bug is caused by ip_route_input dereferencing skb->nh.protocol of
the dummy skb passed dow from inet_rtm_getroute (Thanks Thomas for seeing
it). It only happens if the route requested is for a multicast IP
address.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years agoLinux 2.6.16.7
Greg Kroah-Hartman [Mon, 17 Apr 2006 21:53:25 +0000 (14:53 -0700)]
Linux 2.6.16.7

11 years ago[PATCH] fix MADV_REMOVE vulnerability (CVE-2006-1524 for real this time)
Hugh Dickins [Mon, 17 Apr 2006 21:46:32 +0000 (22:46 +0100)]
[PATCH] fix MADV_REMOVE vulnerability (CVE-2006-1524 for real this time)

madvise_remove needs to respect file and mmap protections.

Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years agoLinux 2.6.16.6
Greg Kroah-Hartman [Mon, 17 Apr 2006 20:36:51 +0000 (13:36 -0700)]
Linux 2.6.16.6

11 years ago[PATCH] shmat: stop mprotect from giving write permission to a readonly attachment...
Hugh Dickins [Wed, 12 Apr 2006 21:34:27 +0000 (14:34 -0700)]
[PATCH] shmat: stop mprotect from giving write permission to a readonly attachment (CVE-2006-1524)

I found that all of 2.4 and 2.6 have been letting mprotect give write
permission to a readonly attachment of shared memory, whether or not IPC
would give the caller that permission.

SUS says "The behaviour of this function [mprotect] is unspecified if the
mapping was not established by a call to mmap", but I don't think we can
interpret that as allowing it to subvert IPC permissions.

I haven't tried 2.2, but the 2.2.26 source looks like it gets it right; and
the patch below reproduces that behaviour - mprotect cannot be used to add
write permission to a shared memory segment attached readonly.

This patch is simple, and I'm sure it's what we should have done in 2.4.0:
if you want to go on to switch write permission on and off with mprotect,
just don't attach the segment readonly in the first place.

However, we could have accumulated apps which attach readonly (even though
they would be permitted to attach read/write), and which subsequently use
mprotect to switch write permission on and off: it's not unreasonable.

I was going to add a second ipcperms check in do_shmat, to check for
writable when readonly, and if not writable find_vma and clear VM_MAYWRITE.
 But security_ipc_permission might do auditing, and it seems wrong to
report an attempt for write permission when there has been none.  Or we
could flag the vma as SHM, note the shmid or shp in vm_private_data, and
then get mprotect to check.

But the patch below is a lot simpler: I'd rather stick with it, if we can
convince ourselves somehow that it'll be safe.

Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] atm: clip causes unregister hang
Stephen Hemminger [Wed, 12 Apr 2006 21:52:54 +0000 (14:52 -0700)]
[PATCH] atm: clip causes unregister hang

If Classical IP over ATM module is loaded, its neighbor table gets
populated when permanent neighbor entries are created; but these entries
are not flushed when the device is removed. Since the entry never gets
flushed the unregister of the network device never completes.

This version of the patch also adds locking around the reference to
the atm arp daemon to avoid races with events and daemon state changes.
(Note: barrier() was never really safe)

Bug-reference: http://bugzilla.kernel.org/show_bug.cgi?id=6295

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] fix non-leader exec under ptrace
Roland McGrath [Wed, 12 Apr 2006 23:30:20 +0000 (16:30 -0700)]
[PATCH] fix non-leader exec under ptrace

This reverts most of commit 30e0fca6c1d7d26f3f2daa4dd2b12c51dadc778a.
It broke the case of non-leader MT exec when ptraced.
I think the bug it was intended to fix was already addressed by commit
788e05a67c343fa22f2ae1d3ca264e7f15c25eaf.

Signed-off-by: Roland McGrath <roland@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] USB: remove __init from usb_console_setup
Paul Fulghum [Wed, 12 Apr 2006 21:41:59 +0000 (23:41 +0200)]
[PATCH] USB: remove __init from usb_console_setup

This prevents an Oops if booted with "console=ttyUSB0" but without a
USB-serial dongle, and plugged one in afterwards.

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] Fix suspend with traced tasks
Pavel Machek [Fri, 31 Mar 2006 10:30:06 +0000 (02:30 -0800)]
[PATCH] Fix suspend with traced tasks

strace /bin/bash misbehaves after resume; this fixes it.

(akpm: it's scary calling refrigerator() in state TASK_TRACED, but it seems to
do the right thing).

Signed-off-by: Pavel Machek <pavel@suse.cz>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] Incorrect signature sent on SMB Read
Steve French [Fri, 31 Mar 2006 21:22:00 +0000 (21:22 +0000)]
[PATCH] Incorrect signature sent on SMB Read

Fixes Samba bug 3621 and kernel.org bug 6147

For servers which require SMB/CIFS packet signing, we were sending the
wrong signature (all zeros) on SMB Read request.  The new cifs routine
to do signatures across an iovec was not complete - and SMB Read, unlike
the new SMBWrite2, did not fall back to the older routine (ie use
SendReceive vs. the more efficient SendReceive2 ie used the older
cifs_sign_smb vs. the disabled  cifs_sign_smb2) for calculating signatures.

This finishes up cifs_sign_smb2/cifs_calc_signature2 so that the callers
of SendReceive2 can get SMB/CIFS packet signatures.

Now that cifs_sign_smb2 is supported, we could start using it in
the write path but this smaller fix does not include the change
to use SMBWrite2 when signatures are required (which when enabled
will make more Writes more efficient and alloc less memory).
Currently Write2 is only used when signatures are not
required at the moment but after more testing we will enable
that as well).

Thanks to James Slepicka and Sam Flory for initial investigation.

Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] RLIMIT_CPU: fix handling of a zero limit
Andrew Morton [Fri, 24 Mar 2006 11:18:35 +0000 (03:18 -0800)]
[PATCH] RLIMIT_CPU: fix handling of a zero limit

At present the kernel doesn't honour an attempt to set RLIMIT_CPU to zero
seconds.  But the spec says it should, and that's what 2.4.x does.

Fixing this for real would involve some complexity (such as adding a new
it-has-been-set flag to the task_struct, and testing that everwhere, instead
of overloading the value of it_prof_expires).

Given that a 2.4 kernel won't actually send the signal until one second has
expired anyway, let's just handle this case by treating the caller's
zero-seconds as one second.

Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Ulrich Weigand <uweigand@de.ibm.com>
Cc: Cliff Wickman <cpw@sgi.com>
Acked-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
11 years ago[PATCH] Fix utime(2) in the case that no times parameter was passed in.
Nathan Scott [Tue, 11 Apr 2006 05:12:45 +0000 (15:12 +1000)]
[PATCH] Fix utime(2) in the case that no times parameter was passed in.

SGI-PV: 949858
SGI-Modid: xfs-linux-melb:xfs-kern:25717a

Signed-off-by: Jes Sorensen <jes@sgi.com>
Signed-off-by: Nathan Scott <nathans@sgi.com>
11 years ago[PATCH] alpha: SMP boot fixes
Brian Uhrain says [Tue, 11 Apr 2006 05:53:16 +0000 (22:53 -0700)]
[PATCH] alpha: SMP boot fixes

I've encountered two problems with 2.6.16 and newer kernels on my API CS20
(dual 833MHz Alpha 21264b processors).  The first is the kernel OOPSing
because of a NULL pointer dereference while trying to populate SysFS with the
CPU information.  The other is that only one processor was being brought up.
I've included a small Alpha-specific patch that fixes both problems.

The first problem was caused by the CPUs never being properly registered using
register_cpu(), the way it's done on other architectures.

The second problem has to do with the removal of hwrpb_cpu_present_mask in
arch/alpha/kernel/smp.c.  In setup_smp() in the 2.6.15 kernel sources,
hwrpb_cpu_present_mask has a bit set for each processor that is probed, and
afterwards cpu_present_mask is set to the cpumask for the boot CPU.  In the
same function of the same file in the 2.6.16 sources, instead of
hwrpb_cpu_present_mask being set, cpu_possible_map is updated for each probed
CPU.  cpu_present_mask is still set to the cpumask of the boot CPU afterwards.
 The problem lies in include/asm-alpha/smp.h, where cpu_possible_map is
#define'd to be cpu_present_mask.

Cleanups from: Ivan Kokshaysky <ink@jurassic.park.msu.ru>

 - cpu_present_mask and cpu_possible_map are essentially the same thing
   on alpha, as it doesn't support CPU hotplug;
 - allocate "struct cpu" only for present CPUs, like sparc64 does.
   Static array of "struct cpu" is just a waste of memory.

Signed-off-by: Brian Uhrain <buhrain@rosettastone.com>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] cciss: bug fix for crash when running hpacucli
Mike Miller [Mon, 10 Apr 2006 22:38:07 +0000 (15:38 -0700)]
[PATCH] cciss: bug fix for crash when running hpacucli

Fix a crash when running hpacucli with multiple logical volumes on a cciss
controller.  We were not properly initializing the disk->queue and causing
a fault.

Thanks to Hasso Tepper for reporting the problem.  Thanks to Steve Cameron
for root causing the problem.  Most of the patch just moves things around.
The fix is a one-liner.

Signed-off-by: Mike Miller <mike.miller@hp.com>
Signed-off-by: Stephen Cameron <steve.cameron@hp.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] edac_752x needs CONFIG_HOTPLUG
Randy Dunlap [Mon, 10 Apr 2006 18:54:24 +0000 (20:54 +0200)]
[PATCH] edac_752x needs CONFIG_HOTPLUG

EDAC_752X uses pci_scan_single_device(), which is only available
if CONFIG_HOTPLUG is enabled, so limit this driver with HOTPLUG.

This patch was already included in Linus' tree.

Adrian Bunk:
Rediffed for 2.6.16.x due to unrelated context changes.

Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: David S. Peterson <dsp@llnl.gov>
11 years ago[PATCH] ext3: Fix missed mutex unlock
Ananiev, Leonid I [Tue, 11 Apr 2006 05:54:38 +0000 (22:54 -0700)]
[PATCH] ext3: Fix missed mutex unlock

Missed unlock_super()call is added in error condition code path.

Signed-off-by: Leonid Ananiev <leonid.i.ananiev@intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] Fix block device symlink name
Stephen Rothwell [Mon, 10 Apr 2006 07:17:20 +0000 (00:17 -0700)]
[PATCH] Fix block device symlink name

As noted further on the this file, some block devices have a / in their
name, so fix the "block:..." symlink name the same as the /sys/block name.

Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] Fix buddy list race that could lead to page lru list corruptions
Nick Piggin [Mon, 10 Apr 2006 23:54:00 +0000 (16:54 -0700)]
[PATCH] Fix buddy list race that could lead to page lru list corruptions

Rohit found an obscure bug causing buddy list corruption.

page_is_buddy is using a non-atomic test (PagePrivate && page_count == 0)
to determine whether or not a free page's buddy is itself free and in the
buddy lists.

Each of the conjuncts may be true at different times due to unrelated
conditions, so the non-atomic page_is_buddy test may find each conjunct to
be true even if they were not both true at the same time (ie. the page was
not on the buddy lists).

Signed-off-by: Martin Bligh <mbligh@google.com>
Signed-off-by: Rohit Seth <rohitseth@google.com>
Signed-off-by: Nick Piggin <npiggin@suse.de>
Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] fuse: fix oops in fuse_send_readpages()
Miklos Szeredi [Tue, 11 Apr 2006 16:37:57 +0000 (18:37 +0200)]
[PATCH] fuse: fix oops in fuse_send_readpages()

During heavy parallel filesystem activity it was possible to Oops the
kernel.  The reason is that read_cache_pages() could skip pages which
have already been inserted into the cache by another task.
Occasionally this may result in zero pages actually being sent, while
fuse_send_readpages() relies on at least one page being in the
request.

So check this corner case and just free the request instead of trying
to send it.

Reported and tested by Konstantin Isakov.

Signed-off-by: Miklos Szeredi <miklos@szeredi.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] m32r: Fix cpu_possible_map and cpu_present_map initialization for SMP kernel
Hirokazu Takata [Tue, 11 Apr 2006 05:53:18 +0000 (22:53 -0700)]
[PATCH] m32r: Fix cpu_possible_map and cpu_present_map initialization for SMP kernel

This patch fixes a boot problem of the m32r SMP kernel 2.6.16-rc1-mm3 or
later.

In this patch, cpu_possible_map is statically initialized, and cpu_present_map
is also copied from cpu_possible_map in smp_prepare_cpus(), because the m32r
architecture has not supported CPU hotplug yet.

Signed-off-by: Hayato Fujiwara <fujiwara.hayato@renesas.com>
Signed-off-by: Hirokazu Takata <takata@linux-m32r.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] m32r: security fix of {get, put}_user macros
Hirokazu Takata [Tue, 11 Apr 2006 05:53:20 +0000 (22:53 -0700)]
[PATCH] m32r: security fix of {get, put}_user macros

Update {get,put}_user macros for m32r kernel.
- Modify get_user to use __get_user_asm macro, instead of __get_user_x macro.
- Remove arch/m32r/lib/{get,put}user.S.
- Some cosmetic updates.

I would like to thank NIIBE Yutaka for his reporting about the m32r kernel's
security problem in {get,put}_user macros.

There were no address checking for user space access in {get,put}_user macros.
 ;-)

Signed-off-by: Hirokazu Takata <takata@linux-m32r.org>
Cc: NIIBE Yutaka <gniibe@fsij.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] NETFILTER: Fix fragmentation issues with bridge netfilter
Patrick McHardy [Thu, 6 Apr 2006 16:51:38 +0000 (18:51 +0200)]
[PATCH] NETFILTER: Fix fragmentation issues with bridge netfilter

[NETFILTER]: Fix fragmentation issues with bridge netfilter

The conntrack code doesn't do re-fragmentation of defragmented packets
anymore but relies on fragmentation in the IP layer. Purely bridged
packets don't pass through the IP layer, so the bridge netfilter code
needs to take care of fragmentation itself.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] sky2: bad memory reference on dual port cards
Stephen Hemminger [Thu, 6 Apr 2006 00:47:15 +0000 (17:47 -0700)]
[PATCH] sky2: bad memory reference on dual port cards

Sky2 driver will oops referencing bad memory if used on
a dual port card.  The problem is accessing past end of
MIB counter space.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] isd200: limit to BLK_DEV_IDE
Randy Dunlap [Wed, 5 Apr 2006 19:03:45 +0000 (12:03 -0700)]
[PATCH] isd200: limit to BLK_DEV_IDE

Limit USB_STORAGE_ISD200 to whatever BLK_DEV_IDE and USB_STORAGE
are set to (y, m) since isd200 calls ide_fix_driveid() in the
BLK_DEV_IDE code.

Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] MPBL0010 driver sysfs permissions wide open
Mark Bellon [Wed, 5 Apr 2006 08:06:06 +0000 (01:06 -0700)]
[PATCH] MPBL0010 driver sysfs permissions wide open

The MPBL0010 Telco clock driver (drivers/char/tlclk.c) uses 0222 (anyone
can write) permissions on its writable sysfs entries.  Alter the
permissions to 0220 (owner and group can write).

The use case for this driver is to configure the fail over behavior of the
clock hardware.  That should be done by the more privileged users.

Signed-off-by: Mark Bellon <mbellon@mvista.com>
Acked-by: Gross Mark <mark.gross@intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] powerpc: fix incorrect SA_ONSTACK behaviour for 64-bit processes
Laurent MEYER [Wed, 5 Apr 2006 22:45:19 +0000 (08:45 +1000)]
[PATCH] powerpc: fix incorrect SA_ONSTACK behaviour for 64-bit processes

*) When setting a sighandler using sigaction() call, if the flag
SA_ONSTACK is set and no alternate stack is provided via sigaltstack(),
the kernel still try to install the alternate stack. This behavior is
the opposite of the one which is documented in Single Unix
Specifications V3.

*) Also when setting an alternate stack using sigaltstack() with the
flag SS_DISABLE, the kernel try to install the alternate stack on
signal delivery.

These two use cases makes the process crash at signal delivery.

This fixes it.

Signed-off-by: Laurent Meyer <meyerlau@fr.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] powerpc: iSeries needs slb_initialize to be called
Stephen Rothwell [Wed, 5 Apr 2006 00:41:21 +0000 (10:41 +1000)]
[PATCH] powerpc: iSeries needs slb_initialize to be called

Since the powerpc 64k pages patch went in, systems that have SLBs
(like Power4 iSeries) needed to have slb_initialize called to set up
some variables for the SLB miss handler.  This was not being called
on the boot processor on iSeries, so on single cpu iSeries machines,
we would get apparent memory curruption as soon as we entered user mode.

This patch fixes that by calling slb_initialize on the boot cpu if the
processor has an SLB.

Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years agoLinux 2.6.16.5
Greg Kroah-Hartman [Wed, 12 Apr 2006 20:27:57 +0000 (13:27 -0700)]
Linux 2.6.16.5

11 years ago[PATCH] x86_64: When user could have changed RIP always force IRET (CVE-2006-0744)
Andi Kleen [Wed, 12 Apr 2006 06:19:29 +0000 (08:19 +0200)]
[PATCH] x86_64: When user could have changed RIP always force IRET (CVE-2006-0744)

Intel EM64T CPUs handle uncanonical return addresses differently from
AMD CPUs.

The exception is reported in the SYSRET, not the next instruction.
Thgis leads to the kernel exception handler running on the user stack
with the wrong GS because the kernel didn't expect exceptions on this
instruction.

This version of the patch has the teething problems that plagued an
earlier version fixed.

This is CVE-2006-0744

Thanks to Ernie Petrides and Asit B. Mallick for analysis and initial
patches.

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] x86_64: Clean up execve
Andi Kleen [Wed, 12 Apr 2006 06:18:46 +0000 (08:18 +0200)]
[PATCH] x86_64: Clean up execve

Just call IRET always, no need for any special cases.

Needed for the next bug fix.

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years agoLinux 2.6.16.4
Greg Kroah-Hartman [Tue, 11 Apr 2006 17:19:28 +0000 (10:19 -0700)]
Linux 2.6.16.4

11 years ago[PATCH] RCU signal handling
Oleg Nesterov [Tue, 11 Apr 2006 18:18:58 +0000 (22:18 +0400)]
[PATCH] RCU signal handling

made this BUG_ON() unsafe. This code runs under ->siglock,
while switch_exec_pids() takes tasklist_lock.

Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years agoLinux 2.6.16.3
Greg Kroah-Hartman [Tue, 11 Apr 2006 05:27:44 +0000 (22:27 -0700)]
Linux 2.6.16.3

11 years ago[PATCH] Keys: Fix oops when adding key to non-keyring [CVE-2006-1522]
David Howells [Mon, 10 Apr 2006 17:01:40 +0000 (17:01 +0000)]
[PATCH] Keys: Fix oops when adding key to non-keyring [CVE-2006-1522]

This fixes the problem of an oops occuring when a user attempts to add a
key to a non-keyring key [CVE-2006-1522].

The problem is that __keyring_search_one() doesn't check that the
keyring it's been given is actually a keyring.

I've fixed this problem by:

 (1) declaring that caller of __keyring_search_one() must guarantee that
     the keyring is a keyring; and

 (2) making key_create_or_update() check that the keyring is a keyring,
     and return -ENOTDIR if it isn't.

This can be tested by:

keyctl add user b b `keyctl add user a a @s`

Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years agoLinux 2.6.16.2
Greg Kroah-Hartman [Fri, 7 Apr 2006 16:56:47 +0000 (09:56 -0700)]
Linux 2.6.16.2

11 years ago[PATCH] kdump proc vmcore size oveflow fix
Vivek Goyal [Mon, 3 Apr 2006 23:38:11 +0000 (16:38 -0700)]
[PATCH] kdump proc vmcore size oveflow fix

A couple of /proc/vmcore data structures overflow with 32bit systems having
memory more than 4G.  This patch fixes those.

Signed-off-by: Ken'ichi Ohmichi <oomichi@mxs.nes.nec.co.jp>
Signed-off-by: Vivek Goyal <vgoyal@in.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
11 years ago[PATCH] knfsd: Correct reserved reply space for read requests.
NeilBrown [Thu, 30 Mar 2006 06:01:15 +0000 (22:01 -0800)]
[PATCH] knfsd: Correct reserved reply space for read requests.

NFSd makes sure there is enough space to hold the maximum possible reply
before accepting a request.  The units for this maximum is (4byte) words.
However in three places, particularly for read request, the number given is
a number of bytes.

This means too much space is reserved which is slightly wasteful.

This is the sort of patch that could uncover a deeper bug, and it is not
critical, so it would be best for it to spend a while in -mm before going
in to mainline.

(akpm: target 2.6.17-rc2, 2.6.16.3 (approx))

Discovered-by: "Eivind Sarto" <ivan@kasenna.com>
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>